Prices, cost drivers and 2026 rules
Privacy Act APP 11 and the Notifiable Data Breaches scheme: what they mean for your security spend
When the Privacy Act applies to an Australian small business, what APP 11 requires, the 30-day breach assessment, who to notify, penalties and what to ask your provider.
If the Privacy Act 1988 applies to your business, Australian Privacy Principle 11 requires you to take reasonable steps to protect the personal information you hold from misuse, interference, loss and unauthorised access, modification or disclosure, and the Notifiable Data Breaches (NDB) scheme requires you to assess a suspected data breach within 30 days and notify the OAIC and affected individuals if it is likely to cause serious harm. Most businesses with annual turnover of $3 million or less are exempt, but many small businesses are covered because of exceptions, such as providing a health service or being related to a larger company. Managed security is one of the main ways businesses show "reasonable steps", and your provider's help is critical during the 30-day assessment.
This guide sits under the pricing overview. For ransomware payment reporting, a separate obligation, see the Cyber Security Act guide. This is general information, not legal advice.
Does the Privacy Act apply to you?
The Act applies to "APP entities", which include organisations other than small business operators. Under section 6D, a business is a small business if its annual turnover for the previous financial year was $3,000,000 or less (for a new business, turnover for the current year). But a business is not a small business operator, and the Act applies, if it:
- provides a health service and holds health information (other than in employee records);
- discloses personal information for a benefit, service or advantage, or provides a benefit to collect it (trading in personal information), unless done with consent or as authorised by law;
- is a contracted service provider under a Commonwealth contract;
- is a credit reporting body;
- is a body corporate related to a body corporate that is not a small business; or
- has ever had annual turnover above $3 million for a financial year since starting the business.
Section 6E also treats some small business operators as covered for particular activities, including reporting entities under the AML/CTF Act and businesses accredited under the consumer data right. A small business can also choose to be covered (opt in) under section 6EA, which some do because customers ask for it.
Separately, any business that holds tax file number information as a file number recipient must follow the TFN rules, and the NDB scheme applies to a breach of those rules (section 26WE). Most employers hold TFNs, so this catches many otherwise-exempt businesses for that information.
Not sure? Check the OAIC's small business guidance and get advice. Contracts often require privacy compliance even where the Act does not.
What APP 11 asks of you
APP 11.1 requires reasonable steps to protect personal information. APP 11.3, in force since 11 December 2024, makes clear those steps include technical and organisational measures. APP 11.2 requires you to destroy or de-identify personal information you no longer need, unless a law requires you to keep it.
"Reasonable" depends on the amount and sensitivity of the information, the harm a breach would cause and the cost of the measures. In practice, OAIC guidance and common expectations point to measures such as:
| Measure | Typical managed service that delivers it |
|---|---|
| MFA and access control | Identity management, MDR with identity monitoring |
| Patching and hardening | Managed endpoint, Essential Eight uplift |
| Detecting and responding to intrusions | MDR, SOC-as-a-service |
| Backups and recovery | Managed backup with tested restores |
| Logging to investigate what was accessed | SIEM or log retention |
| Staff awareness | Training and phishing simulation |
| Supplier oversight | Due diligence on providers that handle your data |
| Deleting data you do not need | Data retention policy, often from a vCISO |
The last two matter for managed security itself: your provider may see personal information in logs and emails. Check where that data is stored, who can access it, and what happens to it when the contract ends. See the due-diligence guide.
The NDB scheme step by step
- Contain. Stop the breach where possible. This is where your MDR or incident-response provider earns its fee.
- Assess. If you have reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days (section 26WH). The OAIC treats 30 days as a maximum, not a target.
- Decide. A breach is eligible where there is unauthorised access, disclosure or loss of personal information that a reasonable person would conclude is likely to result in serious harm to any of the individuals, and you have not been able to prevent that harm through remedial action.
- Notify. If it is eligible, prepare a statement for the OAIC as soon as practicable (section 26WK) and notify affected individuals as soon as practicable (section 26WL), either directly or, if that is not practicable, by publishing the statement.
- Review. Fix the cause and record what you did.
Forensic evidence decides how many people you must notify. Without logs showing what an attacker accessed, you may have to assume the worst and notify everyone. That is one practical reason to pay for adequate log retention.
Penalties and other exposure
Since 13 December 2022, the maximum penalty for a body corporate under section 13G is the greatest of $50 million, three times the benefit obtained, or, if the benefit cannot be determined, 30% of adjusted turnover for the relevant period. Since the amendments that commenced on 11 December 2024, section 13G applies to a serious interference with privacy (repeated or continuous conduct is one factor a court may weigh), a lower-tier civil penalty applies to other interferences (section 13H), and the OAIC can issue infringement notices for some specified contraventions (section 13K), and since 10 June 2025 individuals can sue for serious invasions of privacy under a statutory tort. Large penalties are aimed at serious cases, but the investigation, notification and remediation costs of an ordinary breach are significant for any small business.
What to ask your provider
- Will you help us assess a suspected breach within 30 days, including working out what data was accessed?
- How long do you keep logs, and are they enough to show what was accessed?
- Is breach assessment support included, or billed hourly? See IR retainers.
- Where are our logs stored, and who in your organisation can see personal information?
Frequently asked questions
Is the small business exemption being removed?
The Government has proposed further privacy reforms, including about the small business exemption, but as at October 2026 the $3 million exemption in section 6D remains in the Act. Check the OAIC and the Attorney-General's Department for any change.
Do I have to report a ransomware attack to the OAIC?
Only if it is an eligible data breach involving personal information and the Act applies to you. Ransomware payment reporting under the Cyber Security Act is a separate obligation with a different threshold and deadline.
Can my IT provider notify the OAIC for me?
The obligation stays with your business. A provider or lawyer can prepare the statement, but you are responsible for it.
Does an encrypted laptop that is lost count as a breach?
If the encryption is strong and the key was not compromised, unauthorised access may not be likely, so it may not be an eligible breach. Assess each case.
Sources
- Office of the Australian Information Commissioner — small business guidance, APP 11, Notifiable Data Breaches scheme and reporting form
- Federal Register of Legislation — Privacy Act 1988 (sections 6D, 6E, 6EA, 13G, 26WE–26WL, Schedule 1 APP 11)
- ASD's Australian Cyber Security Centre — technical guidance for protecting systems
- Attorney-General's Department — privacy law reform
